Search papers, labs, and topics across Lattice.
This paper introduces Agentra, a multi-agent Intrusion Response System (IRS) that transforms alerts from various security platforms into structured incident response plans based on established frameworks like MITRE ATT&CK and NIST CSF 2.0. By employing a role-scoped agent architecture and a Planner-Validator review loop, Agentra enhances the efficiency and safety of intrusion responses, achieving a significant improvement in F1 score from 0.61 to 0.84 compared to traditional static playbooks. The findings demonstrate that multi-agent response planning not only increases coverage but also maintains necessary analyst oversight and auditability in cybersecurity operations.
Multi-agent response planning can elevate intrusion response effectiveness while ensuring analyst oversight and safety.
Enterprise intrusion response still depends on static playbooks and analyst-driven triage, creating delay between alert generation and containment. We present Agentra, a supervisable multi-agent Intrusion Response System (IRS) framework that converts alerts from IDS, EDR, and XDR platforms into structured incident response plans grounded in MITRE ATT&CK, MITRE D3FEND, and NIST CSF 2.0. Agentra decomposes response reasoning across role-scoped agents, validates proposed plans through a bounded Planner--Validator review loop, screens retrieved threat intelligence through a Moderator security gateway, gates actions through an Action Catalog and risk score, and records decisions in an append-only audit log. We evaluate Agentra against a static OASIS CACAO v2.0 cyber-playbook baseline on a 120-event corpus drawn from ThreatHunter-Playbook, Splunk BOTSv3, and DARPA OpTC. The strongest configuration improves FP-aware IRS F1 from 0.61 to 0.84 and restores the projected harmful-action rate to the static baseline level of 0.0% after Planner-only configurations introduce unsafe overreaction. These results indicate that multi-agent response planning can improve ontology-grounded IRS coverage while preserving analyst approval and auditability.
